CVE-2025-39891

What it actually does

Failure to zero-initialize the chan_stats array in the mwifiex WiFi driver leaves kernel memory uninitialized, allowing potential disclosure of sensitive data from adjacent kernel structures.

Why it matters to the business

On affected Linux systems using mwifiex hardware, attackers with local access could obtain fragments of kernel memory that may contain credentials, keys, or other internal state, increasing risk of further compromise especially on older SUSE deployments.

How an attack unfolds

An attacker with local access triggers the mwifiex driver path that reads the uninitialized chan_stats array, then inspects the returned data for useful kernel memory contents; listed threat actors have not been observed exploiting this specific issue.

How to fix it

Apply the listed fixed versions: python, python-base, and python-doc on SUSE Linux Enterprise Software Development Kit 11 SP4, Server 11 SP4, and Server for SAP Applications 11 SP4 all fixed in 2.6.9-40.6.2 (or 2.6-8.40.6.2 for docs); kernel trees fixed at commit 9eb0118b3470b4d2e4e3bbb1fc088b30c0285d65.

How to confirm the fix worked

Verify the running kernel or package versions match or exceed the listed fixed releases and confirm the chan_stats initialization change is present in the mwifiex source.

Typical attack path

1. Obtain local access on a system with mwifiex WiFi hardware
2. Trigger the driver code path that populates or returns chan_stats
3. Inspect returned or leaked memory for sensitive kernel data
4. Use disclosed information to escalate privileges or access other resources

How to detect it

Review kernel logs and driver traces around mwifiex activity for unexpected memory contents or crashes; no specific exploitation artifacts have been published for this issue.

What your security team should do

• Prioritize patching SUSE systems listed in affected products within standard maintenance windows given low EPSS and absence from KEV
• Confirm mwifiex driver usage and limit local user access where possible until updated
• Monitor for future EPSS increases or new threat actor mentions